From observation to publication.
The collection boundaries, confidence vocabulary, and publication filter behind every field note on this site.
The sensors wait.
The network uses decoy services built on a fork of Beelzebub by Beelzebub.AI. They record inbound interaction across shells, web services, APIs, and AI-oriented endpoints.
Sensors do not initiate scans, deliver exploits, perform reverse DNS against operators, or pursue activity outside the decoy. What reaches the instrument is what enters the study.
Most activity is noise.
Connection attempts, favicon requests, malformed bytes, and routine scanning are retained as volume but do not automatically become findings. Repeated signatures are clustered and low-context probes recede from the default public view.
A session becomes worth closer review when it contains meaningful commands, tool calls, sustained authentication activity, unusual sequence, agent-directed behavior, or another engagement signal.
Confidence is explicit.
When the evidence cannot carry a firm statement, the language must show the gap.
- High
- Direct observation across multiple events or sensors, corroborated where another source can independently support it.
- Medium
- A plausible interpretation of observed behavior with the missing evidence stated alongside it.
- Low
- A working hypothesis only. Useful enough to note, not strong enough to generalize.
Behavior is not identity.
The public record can support a behavioral cluster, a tooling fingerprint, an infrastructure pattern, or an observed sequence. It usually cannot support naming an individual, organization, or nation-state.
Country and network origin describe where a connection appeared. They are not treated as proof of who directed it. Attribution stops where the primary evidence stops.
Redaction comes before presentation.
Attacker-controlled values pass through a default-deny schema and sanitization boundary before rendering. Working credentials, sensitive payloads, internal sensor identifiers, and third-party details are removed or pseudonymized.
If an interaction creates material risk to a third party, publication is narrowed, delayed, or withheld. Voyeurism never outranks stewardship.
Four questions before anything ships.
- 01
Evidence
Can a reader trace the claim back to something the sensor actually recorded?
- 02
Usefulness
Does the observation change how someone builds, detects, investigates, or understands the system?
- 03
Safety
Have credentials, identities, infrastructure details, and actionable harmful material been removed?
- 04
Proportion
Does the language distinguish a scan, an attempt, an interaction, and a compromise?